94598e621d1f04effb9369b277c2db2ab4862ca2bd08e481208fe3ce7893f279

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 23:42

Target

5e2f07a9619fea3e573322ff4492b1d6_JaffaCakes118.dll
Size

40KB
MD5

5e2f07a9619fea3e573322ff4492b1d6
SHA1

4dc8e123ee603602706f4a98ee822c472b72697b
SHA256

94598e621d1f04effb9369b277c2db2ab4862ca2bd08e481208fe3ce7893f279
SHA512

39f95c06a7c1c1521c611af10e3badd57a60ce4fa21b240472966f3a9e4a5f6e9d604e64a8d9bb3220f2552ebeb35c998ae775a31c9f14fd81d3cf74ca0be322
SSDEEP

768:BlPHgFEwWZLvKzU7kAG7066tX+hP6jWBoRvc:Blvg0KzUQn7066tuhyaoR0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1592	1892	rundll32.exe	30
PID 1892 wrote to memory of 1592	1892	rundll32.exe	30
PID 1892 wrote to memory of 1592	1892	rundll32.exe	30
PID 1892 wrote to memory of 1592	1892	rundll32.exe	30
PID 1892 wrote to memory of 1592	1892	rundll32.exe	30
PID 1892 wrote to memory of 1592	1892	rundll32.exe	30
PID 1892 wrote to memory of 1592	1892	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e2f07a9619fea3e573322ff4492b1d6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e2f07a9619fea3e573322ff4492b1d6_JaffaCakes118.dll,#1
  2⤵
  PID:1592